c# dll obfuscation vs entire project obfuscation

Question

for my primary software product i created a 'keygen' which is obviously able to generate keys and to validate too. It's a 'logic' keygen and i don't want to use it as web service (i don't want to force users to have an internet connection to reg the software..). Fot those reasons i need to obfuscate it with something like Dotfuscator but if obfuscated my project lose some cool stuff like the auto-update bundled with .Net products (ClickOnce).

Then my first question is: It's possible to create the keygen as .dll, obfuscate it and use it in a non-obfuscated software?

If YES:

Will I be able to continue to use the ClickOnce and other non-obuscation advantages?
Will the obfuscation of a single (and small) .dll versus the obfuscation of the entire project makes more easy for hackers to crack the keygen?

If NO:

Will the obfuscation of a single (and small) .dll versus the obfuscation of the entire project makes more easy for hackers to crack the keygen?

Definitively, what's your raccomendations? Thnaks a lot for any help and please forgive my bad english :-)

Why do you "loose" ClickOnce support when obfuscating your main .exe? Have you tried it and gotten failures? — Peter Lillevold
Sorry, yes it is possible but losing all automations: link msdn.microsoft.com/it-it/library/76e4d2xw.aspx the page is in italian language but you can set 'original language' to show the english version. — Steve Rogers
Anyway, bypassing the ClickOnce limit i need to know more if it's better to store the keygen code inside the obfuscated software or in an external obfuscated .dll — Steve Rogers
In addition to what was said in the answer: Also keep in mind that you really have to test your obfuscated software completely and thoroughly again. In my experience obfuscation quite often leads to new bugs in some obscure (:p) way or another. It doesn't have to happen, often it works...sometimes not and what sucks the most for a customer is the find out that the software he bought doesn't work due to "registration issues" — Jens
@Jens this is another great question! If you say that then i come back to my decision and i will create a .dll obfuscated leaving the software clear. Are you sure the obfuscation should compromise the software stability? As i readed in the web the obfuscation make softwares faster, not unstable, but i had a rasonable doubt about this, and you are confirming it :-) — Steve Rogers

AlphaDelta AlphaDelta · Accepted Answer · 2015-04-22T21:46:36

The problem with .NET obfuscation is that anyone who has a fairly intermediate understanding of CIL, which C# is compiled into, will find any obfuscation to be fairly easy to get through, even if they can't get through the obfuscation if the memory isn't properly secured they can just monitor the change in memory throughout the operation of your program.

Anyone who really wants to get into your program, will. It's the same for native applications as well.

That being said if you want to protect yourself from the average script kiddie with a reflector then compiling the keygen to a dll and obfuscating the dll alone is enough for protecting against someone discovering your key generation algorithm and using it to create a keygen, however that still leaves them with the possibility of patching your application which obfuscating that would to some degree prevent.

To summerize: If you want to prevent the average person from creating a keygen compile and obfuscate your keygen to a dll, if you want to prevent both a keygen and people patching your program obfuscate keep the keygen in the solution and obfuscate that.

c# dll obfuscation vs entire project obfuscation

1 Answers